Androguard- Reverse Engineering And Malware Analysis Tool For Android Applications

Androguard- Reverse Engineering And Malware Analysis for Android Applications

Androguard is available for Linux/OSX/Windows written in Python.

Features:

Androguard is a full python tool to play with Android files.

• DEX, ODEX
• APK
• Android's binary xml
• Android resources
• Disassemble DEX/ODEX bytecodes
• Decompiler for DEX/ODEX files

Here extension define as follows

•  * Dex/Odex (Dalvik virtual machine) 
• (.dex) (disassemble, decompilation), 
• * APK (Android application) (.apk), 
• * Android’s binary xml (.xml) 
• * Android Resources (.arsc).

Usage

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

Usage: androlyze.py [options] Options:   -h, --help            show this help message and exit   -i INPUT, --input=INPUT                         file : use this filename   -d, --display         display the file in human readable format   -m METHOD, --method=METHOD                         display method(s) respect with a regexp   -f FIELD, --field=FIELD                         display field(s) respect with a regexp   -s, --shell           open a shell to interact more easily with objects   -v, --version         version of the API   -p, --pretty          pretty print !   -t TYPE_PRETTY, --type_pretty=TYPE_PRETTY                         set the type of pretty print (0, 1) !   -x, --xpermissions    show paths of permissions

Download

Hackers Can Use Your HeadPhones To Spy On You

Hackers Can Use Your HeadPhones For Spy On You

The Security researchers of Israel found new Malware known Speake(a)r that converts headphones into microphones and to record all your personal conversation as a spying device.

In YouTube there are many demonstrate videos. Speake(a)r, the malware is disturbingly able to hijack a computer to record audio even when its microphone is disabled or completely disconnected from the computer.

“This is the real vulnerability,” says Mordechai Guri, the research lead of Ben Gurion’s Cyber Security Research Labs. “It’s what makes almost every computer today vulnerable to this type of attack.”

There’s no simple software patch for the eavesdropping attack, Guri says. The property of RealTek’s audio codec chips that allows a program to switch an output channel to an input isn’t an accidental bug so much as a dangerous feature, Guri says, and one that can’t be easily fixed without redesigning and replacing the chip in future computers.

“People don’t think about this privacy vulnerability. Even if you remove your computer’s microphone, if you use headphones you can be recorded.”

Speake(a)r capture vibrations in the air and converts it into electromagnetic signals, then it  calls the audio jacks functions and then flips input jacks (used by microphones) to output jacks (used for speakers and headphones). Which allows to cyber criminals to record audio.

VolatilityBot – An Automated Memory Analyzer For Malware Samples And Memory Dumps

VolatilityBot – An Automated Memory Analyzer For Malware Samples And Memory Dumps

VolatilityBot is an automation tool for researchers cuts all the guesswork and manual tasks out of the binary extraction phase, or to help the investigator in the first steps of performing a memory analysis investigation. Not only does it automatically extract the executable (exe), but it also fetches all new processes created in memory, code injections, strings, IP addresses, etc.

Motivation

Part of the work security researchers have to go through when they study new malware or wish to analyse suspicious executables is to extract the binary file and all the different injections and strings decrypted during the malware’s execution.

In the new version of VolatilityBot, a new feature is automated analysis of memory dumps, using heuristics and YARA/Clam AV Scanners (Clam scan coming soon). This feature is useful for memory analysis at scale. Usually, this initial process is done manually, either of a malware sample, or a memory dump and it can be lengthy and tedious.

Current features

Automated analysis of malware samples (Based on diff-ing between clean memory image and infected one )

• Extraction of injected code
• Dump of new processes
• Yara scan, static analysis, string extraction, etc. on all outputs

Automated heuristic analysis of memory dumps

• Detect anomallies using heuristics and dump the relevant code
• Yara scan, static analysis, string extraction, etc. on all outputs.

Prepare the VM (Currently only vmware)

Create a new virtual machine, with Windows XP up to windows 10 x64.
Make sure the machine has windows defender and FW disabled, and has a static IP
Install python 3.5
Create c:\temp folder, or change the destination folder in config
Copy the agent.py from Utils and launch it (you can execute it without the console using pythonw.exe)
Take a snapshot of the VM
repeat steps 1-6 for as many VMs as you want

Configuring the host

Edit the required parameters, as instructed in the conf/conf.py file
Execute db_builder.py - in order to create the database
Execute gi_builder.py - in order to build the golden images for all active VMs

Submit

Analyze a memory dump using heuristics, and dump output to folder
VolatilityBot.py  -m --dump -f /Users/Martin/Downloads/stuxnet.vmem

Submit an executable and analyze it using Volatility:
VolatilityBot.py  -f <Sample Path>
VolatilityBot.py  -D

Download Tool

A Simple Static Malware Analyzer SSMA Tool Written in Python 3

SSMA is a simple malware analyzer written in Python 3. 

Features: 

1. Analyze PE file’s header and sections (number of sections, entropy of sections/PE file, suspicious section names, suspicious flags in the characteristics of the PE file, etc.) 
2. Searches for possible domains, e-mail addresses, IP addresses in the strings of the file. 
3. Checks if domain is blacklisted based on abuse.ch’s Ransomware Domain Blocklist and malwaredomains.com’s blocklist. 
4. Looks for Windows functions commonly used by malware. 
5. Get results from VirusTotal and/or upload files. 
6. Malware detection based on Yara-rules 
7. Detect well-known software packers. 
8. Detect the existence of cryptographic algorithms. 
9. Detect anti-debug and anti-virtualization techniques used by malware to evade automated analysis. 
10. Find if documents have been crafted to leverage malicious code. 

Usage: 

git clone https://github.com/secrary/SSMA
cd SSMA
sudo pip3 install -r requirements.txt
python3 ssma.py -h
python3 ssma.py -k api-key file.exe

You can just statically scan the file or upload to VirustTotal using your API-KEY.

python3 ssma.py file.exe
python3 ssma.py -k api-key file.exe

Download

CryLocker Ransomware Gather Victim Wi-Fi Network Information And Location On Google Map

CryLocker Ransomware Gather Victim Wi-Fi Network Information And Location On Google Map.

• Over 10,000 Users Infected from CryLocker Ransomware. 
• Files extension changes to *.CRY. Detected By TrendMicro and MalwareHunterTeam.
• It Spread through Free online image hosting sites.

CyberCriminals can track their victims from PNG image files. After owned information from victim computers, CryLocker Ransomware sends PNG file to an Imgur album.

According to Trendmicro,
A malvertising (malicious advertising) campaign was found to be distributing this ransomware through Rig exploit kit last September 1. From September 2 onwards, this campaign stopped pushing this threat as their payload. Upon closer inspection to the uploaded PNG files in Imgur, the initial information we spotted there was encrypted as early as August 25.

Some languages are detected such as Belarusian, Kazakh, Russian, Sakha, Ukrainian and Uzbek.

CryLocker Ransomware Note. Credit: Trendmicro

How does it work?

CryLocker Ransomware first copies the files to encrypt them after that it deletes the original files. Various Ransomware just using for encrypting the computer data. Crylocker Ransomware developers ask victim to pay 1.1Bitcoin around $630USD to unlock their files. This Ransomware also detects Wi-Fi network details to show the victim location on Google Maps.

How can we Protect?

• Do not click on suspicious files.
• Always On your Browser protection.

LuaBot First Botnet Malware To Target Linux Platforms

View the binary's ASCII in the last part and you'll see the first email address | Credit: MalwareMustDie 

Researchers Finds LUA Language ELF Compiled Malware Called As Linux/LuaBot.

Trojan coded in Lua to target linux Platforms to adding into a Botnet explain by security researcher from MalwareMustDie.

The code is interacted with the udp.lua, as per its name suggesting a lua library of User Datagram Protocol function and struct, This is showing the malware has its own lua resolver code for the DNS query, and has ability to form its own UDP packet to be sent to any destination.

There's also the telnet.lua codes compiled in this ELF, which is after being reversed it seems to be a simple telnet basic communication functions interpreted in lua language (that can be found many references in the internet) that may allow Linux/LuaBot to communicate remotely through this protocol.

What is LUA?

Lua is a powerful, efficient, lightweight, embeddable scripting language. It supports procedural programming, object-oriented programming, functional programming, data-driven programming, and data description.

Lua combines simple procedural syntax with powerful data description constructs based on associative arrays and extensible semantics. Lua is dynamically typed, runs by interpreting bytecode with a register-based virtual machine, and has automatic memory management with incremental garbage collection, making it ideal for configuration, scripting, and rapid prototyping.

According to Softpedia,

At the moment, the LuaBot trojan is packed as an ELF binary that targets ARM platforms, usually found in embedded (IoT) devices. Based on his experience, this seems to be the first Lua-based malware family packed as an ELF binary spreading to Linux platforms.

MalwareMustDie" also found penetrate_sucuri" part, a symbol (suggested a reversed function) traced to be coded in the lua source file: *cough* "checkanus_sucuranus.lua" and "checkanus.lua", which I took only a peek for it, it forms (http) action to a defined target. 

How This Trick Can Hijack Your Chrome Browsers

How This Trick Can Hijack Your Chrome Browsers.

Tech support scammers using Social engineering technique  and show fake Google UI Toolbar in the form of JPEG.

Malware bytes Labs discovers that, the Fake address bar which looks like Microsoft website link: https://support.microsoft.com/ru-ru/en. Here attacker trying to steal user credential through tech support scam and also can say Social Engineering technique.

MalwareBytes notice that the address bar is nothing but a JPEG picture that is placed in the right spot to look like an actual address bar when the page loaded in full-screen mode. To make matters more confusing this particular scam is hosted on Amazon, and that is the correct address bar.

Fake Dialog Box PopUp in Google Chrome is the “Prevent this page from displaying additional dialogs” option particularly useful when certain websites ask you “Are you sure you want to leave this page?” followed by “Are you really, truly sure you want to do it?” and some.

Users also gets Fake calls from Tech Support Scams like,

Hello, we are calling from Windows and your computer looks like it is infected. Our Microsoft Certified Technician can fix it for you.

Conclusion:

• Be alert from these fake Popups.
• Don't give personal information via CALL. 

CuckooDroid - Automated Android Malware Analysis Tool

CuckooDroid - Automated Android Malware Analysis with Cuckoo Sandbox.

CuckooDroid is an extension of Cuckoo Sandbox the Open Source software for automating analysis of suspicious files, CuckooDroid brigs to cuckoo the capabilities of execution and analysis of android application.

CuckooDroid featured with VM-detection techniques, encryption key extraction, SSL inspection, API call trace, basic behavioural signatures. Also provides both static and dynamic APK inspection.

Installation - Easy integration script:

git config --global user.email "you@example.com"
git config --global user.name "Your Name"
git clone --depth=1 https://github.com/cuckoobox/cuckoo.git cuckoo -b 1.2
cd cuckoo
git remote add droid https://github.com/idanr1986/cuckoo-droid
git pull --no-edit -s recursive -X theirs droid master 
cat conf-extra/processing.conf >> conf/processing.conf
cat conf-extra/reporting.conf >> conf/reporting.conf
rm -r conf-extra
echo "protobuf" >> requirements.txt

Download

HEIST Attack On HTTPS Websites Can Steals Your Private Data

HEIST Attack On HTTPS Websites Can Steals Your Private Data

Two Security researchers Mathy Vanhoef and Tom Van Goethem explained their finding in Black Hat Conference this week. HEIST is defined as (HTTP Encrypted Information can be Stolen Through TCP-Windows)

Compression-based attacks such as CRIME and BREACH can now be performed purely in the browser, by any malicious website or script, without requiring network access," the researchers said in the paper.

"If we know that HTTP/2 is used, we can let the browser simultaneously request the targeted resource, and another resource that contains reflected content," Vanhoef and Van Goethem wrote in a research paper. "Since HTTP/2 is used, both requests are sent in parallel to the server, and the server replies to them in parallel as well."

How this attack work?

It is possible to exploit two earlier attacks, BREACH and CRIME attack, to decrypt the transmitted data without the attacker having to be in a man-in-the-middle (MITM) position on the network. When a visitor surfing a compromised website, then the malicious code silently runs in the background. HEIST works with both the older HTTP/1.x and the new HTTP/2 protocols.

According to Ars,

Van Goethem and fellow researcher Mathy Vanhoef have already disclosed their findings to researchers at both Google and Microsoft. That means Wednesday's demonstration isn't likely to catch them by surprise. Still, when asked how possiblel the attack is against Gmail, Bank of America, and other real-world sites, Van Goethem gave the following answer:

If I would take my time, and write exploits for a number of websites, then visiting a malicious site (it even doesn't have to be a malicious one, there could also happen to be a malicious JavaScript file on there; there are numerous of possibilities for that to happen), could cause a lot of havoc. Probably the most damage could be dealt out by exploiting BREACH, as it allows the attacker to read out CSRF tokens. Depending on the functionality offered by the website, it could be that by knowing the CSRF token the attacker could simply take over the complete account of the victim.I haven't inspected the requests and responses of every website in detail, but as a user one should expect the worst. An attacker only has to find a single endpoint that contains a secret token and reflects part of the request in the response to extract this token. As I mentioned, knowing this token is typically enough to compromise the user's account.

How To Protect?

1. To Disable Third Party Cookies
2. By Disabling third-party cookies would prevent HEIST's fetch() call from authenticating with the invaded webpage.

As we have posted related story earlier,

• Top Media Websites Are Hitting By The Malvertising Campaign
• How To Break SSL Protection via MITM Attack With SSLStrip Tool
• Malvertising Hits 10 Million In 10 Days You Might Be Under Attack While Surfing The Web